DNSSEC - does the domain owner owns a key?

Question

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS holds a key pair that signs the keys of the level below it (e.g. .com), and so on (.com signs the keys for the example.com DNS serer).

When the client query the recursive DNS (the last DNS in the DNS hierarchy), he gets a signed answer. My question: who owns the signature key that the client receives? is it the domain owner (example.com)? and who provided the domain owner with this key? is it self-generated key pair that is signed by the DNS server above it (.com)?

Please, clarify to me the keys ownership and who generates them?

Answer 1

At each level, in each zone, records are signed by one (or multiple) key, that is itself (the public part) in the zone as a DNSKEY record.

Also in parent zone a DS record (signed in the zone like any other records in that zone) "points" to the DNSKEY below by the virtue of being an hash of it and the domain name.

This is repeated at each level. So if you start from root with a fully trusted key (an anchor, that must exist in each recursive nameserver), you find a signed DS record for some key inside the .com zone where you find its DNSKEY record and all other records there are signed by this key, including the DS record of a key for example.com in which zone you will find a DNSKEY record which key signs all other records, hence generating RRSIG records.

(This is of course simplified as often you have separate Zone Signing Keys and Key Signing Keys but this does not change the general idea above).

The keys are typically auto-generated by the nameserver or some external tools at some frequency (typically counted in months or few years). They must absolutely not be handled/generated by the parent zone, each zone is responsible of its keys, how much it has of them, how often it changes them, where are they stored (like on an HSM offline for the KSKs or simply on the filesystem). Each zone only gives a DS record (one per key, specifically one per KSK, including those that do not correspond to published DNSKEY records yet, as a backup), to its parent zone, in order to build the chain of trust.

So it can be the owner of the domain or the DNSSEC signing (and hence key generating service) can be outsourced: some providers will give you a nameserver acting as a bump into the wire, it will serve a signed zone from your content by being a slave of your own nameservers serving an unsigned zone and managing the keys and signatures itself.

The signatures in example.com are owned in a way (depends what you mean by owned) by the authoritative nameservers on this zone. They are either pre-calculated or calculated when the requests arrive (both models exist). Signatures themselves have a starting date and an end date.

Use an online tool like https://dnsviz.net/ to graphically display the chain of trust for any domain. Pass your mouse on various parts of the picture, you have overlays with a lot of useful information.

You can also use dig +trace +dnssec locally. Or better now delv +vtrace or drill -S.